Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/02/2024, 08:05

General

  • Target

    a15d9a1f634a6597db71badaf2c867c6.exe

  • Size

    1.4MB

  • MD5

    a15d9a1f634a6597db71badaf2c867c6

  • SHA1

    548afc66e8dbdbb964e01ff4ac2c981677d050db

  • SHA256

    8b096307d6791375016e1b2abd1a9646afa1d9007646d3015ffca7db695c6eb4

  • SHA512

    1eddc79b4e42f88e15b68f414ee73db492c743fce3ee9d21d57fcba2abee8d0b15592375a504d6da18762223114311a7122eaf904abd03af8673f97aab9be434

  • SSDEEP

    24576:bNr/4p6qO4pDlPJsZtZQk5p8hulbEwfDpBzjRvdsxlTShiVNB:Z/4Qf4pxPctqG8IllnxvdsxZ4Uj

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 10 IoCs
  • Drops file in Program Files directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 58 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a15d9a1f634a6597db71badaf2c867c6.exe
    "C:\Users\Admin\AppData\Local\Temp\a15d9a1f634a6597db71badaf2c867c6.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4488
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" http://taourl.com/6jb4v
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2168
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://taourl.com/6jb4v
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3596
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3596 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:3216
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" http://www.178gg.com/lianjie/10608.htm
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3260
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.178gg.com/lianjie/10608.htm
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1556
    • C:\Windows\SysWOW64\Wscript.exe
      "C:\Windows\system32\Wscript" "C:\Program Files (x86)\soft202504\b_2004.vbs"
      2⤵
        PID:836

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\soft202504\b_2004.vbs

      Filesize

      293B

      MD5

      8fc4c6f63f156aa1810779edf18a9ee0

      SHA1

      8976551f8ff1b80af8d95f15bb0e62892f71a8ba

      SHA256

      0a2139d577089d2c4d5945801c8d65bfe0840c6355e06f60c260b7e50926e296

      SHA512

      43b283a5e4e11a412dd85c31ecfdc081b88cd7653d1a542952f06b5ab8fa8e578229cbd113e04160ed4b375e85fadb340c3df106a47ac23ab1ca07d00c43cdfc

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{897C3890-D2EB-11EE-9A10-F2CAA2420210}.dat

      Filesize

      4KB

      MD5

      59b3432cb472d8dc1dd6f8fff420d936

      SHA1

      47121367dc2638d974a0dbbeb3f5c05d3061b059

      SHA256

      5f61d0970b0b427d61aa5e65ca89b9a134e9f353fe9ca6036a8cf80713ba7c37

      SHA512

      ac97814cb1e0c1333286ca5a587884eecca92bc09ee157ea992a18273fe0676b43d9981bc39dc42818b1c02a9f66c188c593d8192bd907dc6383de24686a2b50

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8980D94C-D2EB-11EE-9A10-F2CAA2420210}.dat

      Filesize

      5KB

      MD5

      15a790a509e2ac66069934e2bfa9d38e

      SHA1

      8540421a32c0e19868887655f5a9c59882d4daba

      SHA256

      7c66beb08d467d25c13abdf34115c2612246b82dd22c669fa68c548fcf17ef7f

      SHA512

      65b35f8c5bf8edbc05e176ca0eb4d3b78ac55ca645beb4dcf19be8de73b65d9baea58bf0b74bf2874c9d7fa2040796d95e0daf0c498e5198d4c47206e14d9907

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver199E.tmp

      Filesize

      15KB

      MD5

      1a545d0052b581fbb2ab4c52133846bc

      SHA1

      62f3266a9b9925cd6d98658b92adec673cbe3dd3

      SHA256

      557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

      SHA512

      bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\APJC04QK\suggestions[1].en-US

      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    • C:\Users\Admin\AppData\Local\Temp\nsu9192.tmp\FindProcDLL.dll

      Filesize

      31KB

      MD5

      83cd62eab980e3d64c131799608c8371

      SHA1

      5b57a6842a154997e31fab573c5754b358f5dd1c

      SHA256

      a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294

      SHA512

      91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9

    • C:\Users\Admin\AppData\Local\Temp\nsu9192.tmp\NSISdl.dll

      Filesize

      14KB

      MD5

      254f13dfd61c5b7d2119eb2550491e1d

      SHA1

      5083f6804ee3475f3698ab9e68611b0128e22fd6

      SHA256

      fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

      SHA512

      fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7